From c0a8f2ed2711c88ef38fe23dafd1296fe51db351 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Thu, 7 May 2026 22:53:33 +0200 Subject: [PATCH] =?UTF-8?q?fix(agent/v1/sw-inventory):=20mirror=20V2=20fix?= =?UTF-8?q?=20=E2=80=94=20accept=20AAD/MSA=20SIDs=20and=20emit=20real=20re?= =?UTF-8?q?gistry=20path?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit V1 carried the same two bugs as V2: the per-user profile enumeration filter only matched S-1-5-21-* SIDs, silently skipping the AAD/MSA cloud SIDs (S-1-12-1-*) that Win10 1903+ uses for AAD-joined users — so on Win11 AAD boxes the per-user Uninstall hive of the actually-logged-in user was never read. Additionally, CollectFromKey logged "{source}\{subKeyPath}" which mashed the telemetry tag (HKU_) with the relative path, producing a non-path string like "HKU_1000\S-1-5-21-...\SOFTWARE\..." in debug logs. Same patch as V2 commit 6c4f7250: extend SID filter to include S-1-12-1-*, log rootKey.Name (HKEY_USERS / HKEY_LOCAL_MACHINE / ...) as the path prefix and report the telemetry tag separately as "(source=...)". Co-Authored-By: Claude Opus 4.7 (1M context) --- .../Analyzers/SoftwareInventoryAnalyzer.cs | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs index 4e5f85a2..15365b52 100644 --- a/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs +++ b/src/Agent/AutopilotMonitor.Agent.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs @@ -441,13 +441,16 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers private void CollectFromKey(RegistryKey rootKey, string subKeyPath, string source, List results) { + // rootKey.Name yields the canonical hive name (HKEY_LOCAL_MACHINE / HKEY_USERS / …), + // so the log line is a real registry path. `source` is a separate telemetry tag + // (e.g. HKLM_64, HKU_) used as RegistrySource on the SoftwareEntry. try { using (var key = rootKey.OpenSubKey(subKeyPath, writable: false)) { if (key == null) { - _logger.Debug($"{Name}: Registry key not found: {source}\\{subKeyPath}"); + _logger.Debug($"{Name}: Registry key not found: {rootKey.Name}\\{subKeyPath} (source={source})"); return; } @@ -490,7 +493,7 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers } catch (Exception ex) { - _logger.Warning($"{Name}: Failed to read {source}\\{subKeyPath}: {ex.Message}"); + _logger.Warning($"{Name}: Failed to read {rootKey.Name}\\{subKeyPath} (source={source}): {ex.Message}"); } } @@ -515,8 +518,12 @@ namespace AutopilotMonitor.Agent.Core.Monitoring.Telemetry.Analyzers foreach (var sid in profileList.GetSubKeyNames()) { - // Only real user profiles (S-1-5-21-*), skip well-known SIDs - if (!sid.StartsWith("S-1-5-21-", StringComparison.OrdinalIgnoreCase)) + // Real user profiles only: + // S-1-5-21-* classic local/AD user accounts + // S-1-12-1-* Microsoft Account / Azure AD cloud SIDs (Win10 1903+ AAD-joined devices) + // Skip well-known service SIDs (S-1-5-18/19/20) and everything else. + if (!sid.StartsWith("S-1-5-21-", StringComparison.OrdinalIgnoreCase) && + !sid.StartsWith("S-1-12-1-", StringComparison.OrdinalIgnoreCase)) continue; // Skip current user SID — already covered by HKCU read above